commit 84dcecbb38bfda010f1c093f6c74776363e05593 Author: Jan de Mooij jdemooij@mozilla.com Date: Mon Jun 17 20:26:56 2019 -0700

Bug 1544386 part 1 - Call ElementAccessHasExtraIndexedProperty instead of ArrayPrototypeHasIndexedProperty when inlining array natives. r=tcampbell a=lizzard

This simplifies the code a bit because ElementAccessHasExtraIndexedProperty checks for length-overflow and sparse-indexes so the callers don't have to do that anymore.

Differential Revision: https://phabricator.services.mozilla.com/D29486

--HG-- extra : amend_source : 545208ea4a5e0646837959eace9b527620a8f7ba --- js/src/jit/MCallOptimize.cpp | 21 +++++---------------- js/src/jit/MIR.cpp | 9 --------- js/src/jit/MIR.h | 2 -- 3 files changed, 5 insertions(+), 27 deletions(-)

diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp index 6f4764313b93..fe10f48b0323 100644 --- a/js/src/jit/MCallOptimize.cpp +++ b/js/src/jit/MCallOptimize.cpp @@ -673,9 +673,10 @@ IonBuilder::InliningResult IonBuilder::inlineArrayPopShift( return InliningStatus_NotInlined; }

+ // Watch out for extra indexed properties on the object or its prototype. bool hasIndexedProperty; MOZ_TRY_VAR(hasIndexedProperty, - ArrayPrototypeHasIndexedProperty(this, script())); + ElementAccessHasExtraIndexedProperty(this, obj)); if (hasIndexedProperty) { trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps); return InliningStatus_NotInlined; @@ -775,16 +776,10 @@ IonBuilder::InliningResult IonBuilder::inlineArrayPush(CallInfo& callInfo) { if (!thisTypes) return InliningStatus_NotInlined; const Class* clasp = thisTypes->getKnownClass(constraints()); if (clasp != &ArrayObject::class_) return InliningStatus_NotInlined; - if (thisTypes->hasObjectFlags( - constraints(), - OBJECT_FLAG_SPARSE_INDEXES | OBJECT_FLAG_LENGTH_OVERFLOW)) { - trackOptimizationOutcome(TrackedOutcome::ArrayBadFlags); - return InliningStatus_NotInlined; - }

bool hasIndexedProperty; MOZ_TRY_VAR(hasIndexedProperty, - ArrayPrototypeHasIndexedProperty(this, script())); + ElementAccessHasExtraIndexedProperty(this, obj)); if (hasIndexedProperty) { trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps); return InliningStatus_NotInlined; @@ -903,17 +898,11 @@ IonBuilder::InliningResult IonBuilder::inlineArraySlice(CallInfo& callInfo) {

const Class* clasp = thisTypes->getKnownClass(constraints()); if (clasp != &ArrayObject::class_) return InliningStatus_NotInlined; - if (thisTypes->hasObjectFlags( - constraints(), - OBJECT_FLAG_SPARSE_INDEXES | OBJECT_FLAG_LENGTH_OVERFLOW)) { - trackOptimizationOutcome(TrackedOutcome::ArrayBadFlags); - return InliningStatus_NotInlined; - }

- // Watch out for indexed properties on the prototype. + // Watch out for extra indexed properties on the object or its prototype. bool hasIndexedProperty; MOZ_TRY_VAR(hasIndexedProperty, - ArrayPrototypeHasIndexedProperty(this, script())); + ElementAccessHasExtraIndexedProperty(this, obj)); if (hasIndexedProperty) { trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps); return InliningStatus_NotInlined; diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp index 4d37c264ae18..87b78b24e09b 100644 --- a/js/src/jit/MIR.cpp +++ b/js/src/jit/MIR.cpp @@ -5671,15 +5671,6 @@ AbortReasonOr<bool> PrototypeHasIndexedProperty(IonBuilder* builder, return false; }

-// Whether Array.prototype, or an object on its proto chain, has an indexed -// property. -AbortReasonOr<bool> jit::ArrayPrototypeHasIndexedProperty(IonBuilder* builder, - JSScript* script) { - if (JSObject* proto = script->global().maybeGetArrayPrototype()) - return PrototypeHasIndexedProperty(builder, proto); - return true; -} - // Whether obj or any of its prototypes have an indexed property. AbortReasonOr<bool> jit::TypeCanHaveExtraIndexedProperties( IonBuilder* builder, TemporaryTypeSet* types) { diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 85b8afff445c..b45eaba68222 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -12575,8 +12575,6 @@ bool PropertyWriteNeedsTypeBarrier(TempAllocator& alloc, PropertyName* name, MDefinition** pvalue, bool canModify, MIRType implicitType = MIRType::None); -AbortReasonOr<bool> ArrayPrototypeHasIndexedProperty(IonBuilder* builder, - JSScript* script); AbortReasonOr<bool> TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types);